In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for
ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with
pkt_len = 0 but ath9k_hif_usb_rx_stream() uses
__dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that
pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb
with uninitialized memory and ath9k_htc_rx_msg() is reading from
uninitialized memory.

Since bytes accessed by ath9k_htc_rx_msg() is not known until
ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid
pkt_len at "if (pkt_len > 2 * MAX_RX_BUF_SIZE) {" line in
ath9k_hif_usb_rx_stream().

We have two choices. One is to workaround by adding __GFP_ZERO so that
ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let
ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose
the latter.

Note that I'm not sure threshold condition is correct, for I can't find
details on possible packet length used by this protocol.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fb9987d0f748c983bb795a86f47522313f701a08 affected < f3d2a3b7e290d0bdbddfcee5a6c3d922e2b7e02a
fb9987d0f748c983bb795a86f47522313f701a08 affected < 84242f15f911f34aec9b22f99d1e9bff19723dbe
fb9987d0f748c983bb795a86f47522313f701a08 affected < 2c485f4f2a64258acc5228e78ffb828c68d9e770
fb9987d0f748c983bb795a86f47522313f701a08 affected < 9661724f6206bd606ecf13acada676a9975d230b
fb9987d0f748c983bb795a86f47522313f701a08 affected < b1b4144508adfc585e43856b31baaf9008a3beb4
fb9987d0f748c983bb795a86f47522313f701a08 affected < 0d2649b288b7b9484e3d4380c0d6c4720a17e473
fb9987d0f748c983bb795a86f47522313f701a08 affected < 4891a50f5ed8bfcb8f2a4b816b0676f398687783
fb9987d0f748c983bb795a86f47522313f701a08 affected < b383e8abed41cc6ff1a3b34de75df9397fa4878c
Linux Linux affected
Version Status Constraints
2.6.35 affected —
0 unaffected < 2.6.35
4.14.296 unaffected ≤ 4.14.*
4.19.262 unaffected ≤ 4.19.*
5.4.220 unaffected ≤ 5.4.*
5.10.150 unaffected ≤ 5.10.*
5.15.75 unaffected ≤ 5.15.*
5.19.17 unaffected ≤ 5.19.*
6.0.3 unaffected ≤ 6.0.*
6.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0d2649b288b7b9484e3d4380c0d6c4720a17e473 cve-icon cve-icon
https://git.kernel.org/stable/c/2c485f4f2a64258acc5228e78ffb828c68d9e770 cve-icon cve-icon
https://git.kernel.org/stable/c/4891a50f5ed8bfcb8f2a4b816b0676f398687783 cve-icon cve-icon
https://git.kernel.org/stable/c/84242f15f911f34aec9b22f99d1e9bff19723dbe cve-icon cve-icon
https://git.kernel.org/stable/c/9661724f6206bd606ecf13acada676a9975d230b cve-icon cve-icon
https://git.kernel.org/stable/c/b1b4144508adfc585e43856b31baaf9008a3beb4 cve-icon cve-icon
https://git.kernel.org/stable/c/b383e8abed41cc6ff1a3b34de75df9397fa4878c cve-icon cve-icon
https://git.kernel.org/stable/c/f3d2a3b7e290d0bdbddfcee5a6c3d922e2b7e02a cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025122421-CVE-2022-50709-54af@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50709 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50709 cve-icon
History

Fri, 26 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 24 Dec 2025 11:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at "if (pkt_len > 2 * MAX_RX_BUF_SIZE) {" line in ath9k_hif_usb_rx_stream(). We have two choices. One is to workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not sure threshold condition is correct, for I can't find details on possible packet length used by this protocol.
Title wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-02T15:03:58.202Z

Reserved: 2025-12-24T10:53:15.518Z

Link: CVE-2022-50709

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-24T11:15:51.080

Modified: 2025-12-29T15:58:56.260

Link: CVE-2022-50709

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2022-50709 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.